Variables not matching number of paramters

Question

Getting a WARNING: MYSQLI_STMT::BIND_PARAM(): NUMBER OF VARIABLES DOESN'T MATCH NUMBER OF PARAMETERS IN PREPARED STATEMENT IN line 45 , i've counted the number of parameters i believe its correct, being 6 parameters but still getting an error message, My knowledge of coding is substandard and was told to update my co as it was open to sql injection

mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
try {
$mysqli = new mysqli("????", "?????", "", "?????");
$mysqli - > set_charset("utf8mb4");
} catch (Exception $e) {
error_log($e - > getMessage());
exit('Error connecting to database');
}
/* GET THE DATA FROM Visitor TABLE */
$stmt = $mysqli - > prepare("SELECT * FROM signin WHERE ID='$member[$x]'");
mysqli_stmt_bind_param($stmt, "ssssss", $memberid1, $fname1, $company, $visiting, $vehicle, $date);
$stmt - > execute();
if ($stmt - > affected_rows === 0) exit('No rows updated');
$stmt - > close();

A bit outside the scope of the question, but it appears your code is wide open to SQL injection - consider using [MySQLi prepared statements](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) and best-practice sanitization methods to avoid common security pitfalls. — esqew, Apr 05 '19 at 11:50

score 0 · Answer 1 · answered Apr 05 '19 at 11:50

Just...

INSERT INTO whatever (column1, column2, date) values (?, ?, now())

and use prepared queries because right now you're injecting and that's not good.

EDIT: Even better:

INSERT INTO signout
(id, full_name, company, visiting, vehicle, date)
SELECT id, full_name, company, visiting, vehicle, now()
FROM signin
WHERE id = ?

Variables not matching number of paramters

1 Answers1